The 'sub' claim value is different between Access and Id tokens

Question

I am using the Resource Owner Password grant flow and requesting id token as well (the scope includes openid). I am sending the following to the endpoint:

• client_id
• client_secret
• grant_type=password
• username
• password
• scope

In the response I get the access token and the id token. The value for the sub claim is different between the two tokens. Why is this the case?

Update

It seems that the user id is actually an oid claim. This is described in Azure AD ID token reference.

Text describing the oid claim:

The immutable identifier for an object in the Microsoft identity system, in this case, a user account. This ID uniquely identifies the user across applications - two different applications signing in the same user will receive the same value in the oid claim. The Microsoft Graph will return this ID as the id property for a given user account. Because the oid allows multiple apps to correlate users, the profile scope is required in order to receive this claim. Note that if a single user exists in multiple tenants, the user will contain a different object ID in each tenant - they are considered different accounts, even though the user logs into each account with the same credentials.

Text describing the sub claim:

The principal about which the token asserts information, such as the user of an app. This value is immutable and cannot be reassigned or reused. The subject is a pairwise identifier - it is unique to a particular application ID. Therefore, if a single user signs into two different apps using two different client IDs, those apps will receive two different values for the subject claim. This may or may not be desired depending on your architecture and privacy requirements.

However, I am still not clear why the sub claim is different between the access and id tokens.

Answer 1

The subject (sub) claim is unique for the user and the service for which the token is intended (identified by the audience (aud) claim).

Usually, the ID Token and Access Token audiences will be different: the ID Token audience is the client app where the user is signing in, and the Access Token audience is the resource server the client app will attempt to access (on behalf of the signed-in user).